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Calculation method for elliptic curve cryptography 

The invention relates to a cryptographic method 
employed between two entities exchanging information over 
a non- secure communication channel, for example a cable 
or radio network, the method assuring the confidentiality 
and the integrity of information transfer between the two 
entities. The invention relates more particularly to an 
improvement to cryptosystems employing calculations on an 
elliptic curve. The improve ment mainly reduces the 
calculation time. 

The Dif f ie-Hellmann key exchange cryptographic 
protocol is used to exchange keys securely between two 
entities. Using it entails employing a group in the 
mathematical sense of the term. A group that can be used 
is constituted by an elliptic curve of the following 
type : 

y^ + xy = x^ + ox^+P 
It is known that if P = (x,y) is on the elliptic 

curve E, it is possible to define a "product" or "scalar 

multiplication" of the point P of E by an integer m. This 

operation is defined as follows: 

[m] P = P + P + P + P (m times) 
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Doubling a chosen point P on this kind of elliptic 

curve in a Dif f ie-Hellmann key exchange algorithm is 

known in the art. This operation is known as "point 

doubling" and is part of an iterative double -and- add 

5 process. Any such doubling takes time. 

The slowest part of the Dif f ie-Hellman key exchange 

protocol is multiplying an unknown point on the curve by 

a random scalar. Only elliptic curves defined on a body 

of characteristic- two are considered here; this is a 

10 widely adopted implementation choice, because addition 
within a body of this kind corresponds to the "exclusive- 
or" operation. 

It is known in the art that multiplication by a 
scalar can be accelerated for curves defined on a body of 

15 low cardinality by using the Frobenius morphism. The 
curves can be chosen so that none of the known attacks 
applies to them. However, it is obviously preferable, at 
least in principle, to be able to choose the curve to be 
used from a class of curves that is as general as 

20 possible. The fastest version of the method in accordance 
with the invention is applied to half the elliptic 
curves. Moreover, from a cryptographic point of view. 
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that half is the best half. Before the theory of the 

method is described, the basic concepts are reviewed. 

For simplicity, consider the elliptic curve (E) 
that can be represented geometrically and is defined for 
the set R of real numbers by the equation y^ + y = x"^ - 
shown in figure 1, in which figure a horizontal line 
represents an integer number m, a vertical line 
represents an integer number n and each intersection of 
horizontal and vertical lines represents the integer 
coordinate pair (m, n) . 

(E) passes through a finite number of points with 
integer coordinates and any secant at (E) originating 
from any such point intersects (E) at two points, which 
may be coincident (in the case of tangents to the curve) . 

The addition operation applied to any two of these 
points A and B is defined as follows: let Bi be the point 
at which the straight line s;egment (AB) intersects (E) ; 
the vertical through Bi intersects (E) at C = A + B . 

In the special case where (AB*) is tangential to 
(E) , C* is the required sum. 

The "intersection of all verticals" point O is 
referred to as the point at infinity of (E) and is the 
neutral element of the addition defined in this way 
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since, by 'applying the geometrical construction which 

defines the addition: 

A+0 = O+A = A 

The doubling of A, which is denoted [2] A and 
5 defined as: A + A, is therefore the point B', the 
straight line segment (Ax) being tangential to (E) at A. 

By applying the addition of A construction to the 
point B*, the point [3] A is obtained, and so on: this is 
the definition of the product [n] A of a point by an 
10 integer. 

The present invention in fact relates to a family 
of elliptic curves which cannot be represented 
geometrically but are defined as follows: 

Let n be a given integer, F^n the body of 1^ 

15 elements, and its algebraic closure. Let O be the 

point at infinity. The non- supers ingular elliptic curve E 
defined at F^n is: 

E = { (x,y)G F^n X F^„ |y^ + xy = + ox^ + p} u {O} a, p e ^ ^ Q 

The elements of E are usually referred to as 
20 "points". It is well known in the art that E can be given 
an abelian group structure by taking the point at 
infinity as a neutral element. Hereinafter, the finite 
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subgroup of rational points of E is considered, and is 

defined by: 

E{F^„ ) = {(x,y)e F^^ X F^^ ly^ + xy = + 00^ + p} u {o} a, p e F^^ (3 9^ 0 

where N is the set of natural integers; for all m e N, 
5 the "multiplication by m" application in E is defined by: 
[m] : E 

P-^Ph-..„.. + P (m times) and VPeE:[o]P=0 
E [m] is the kernel of the application. The 

points of the group E [m] are called the m-torsion points 

10 of E. The group structure of the m-torsion points is well 

known in the art , 

In the situation in which m is a power of 2: 

Vke N:E[2']=Z/2*'Z 

where Z is the set of relative integers, 

15 Because E ( F^n ) is a finite sub-group of E, there 

exists k' > 1 such that E [2^] is contained in E ( F^^ ) if 
and only if k < k*. For the elliptic curves E for which 
k'=l, the structure of E ( F^n ) is: 

E(F2„ ) = G X {O, T2} 
2 0 where G is an odd order group and T2 designates the unique 

second order point of E. A curve of this kind is said to 

have a minimal two- torsion. 
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It is now possible to explain the object of the 
invention. Doubling is not injective when it is defined 
on E or E ( F^n ) , because its kernel is: E[2]" = {O, T2} . 

Moreover, if the domain for defining doubling is 
reduced to an odd order sub-group G c= E ( F^^ ) doubling 

becomes bi jective . 

As a result doubling allows an inverse application 
to the sub-group that is referred to hereinafter as 
halving : 

[1/2] : G^G 

P^Q such that: [2] Q = P 

[1/2] P is the point of G to which the doubling 

application makes the point P correspond. 

For all k>l: 

iM^m 4i] 

represents k compositions of the halving 
application with itself. 

Generally speaking, the invention therefore 
provides a cryptographic method employed between two 
entities exchanging information via a non- secure 
communication channel, the method including a step of 
multiplying an odd order point of a non-supersingular 
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elliptic curve by an integer, characterized in that, for 

exchanging information via the non- secure communication 

channel, the above step includes addition and halving of 

points of said elliptic curve, the addition of points is 

5 an operation known in the art, the halving of a point P 

is defined as the unique odd order point D such that [2]D 

= P, l^^j denotes the halving operation and 

the point D. 

The halving application is beneficial for the 
10 scalar multiplication of a point on an elliptic curve for 
the following reason: if affine coordinates are used, it 
is possible to replace all doublings of a point of a 
scalar multiplication by halvings of a point. 

The halving of a point is much faster to calculate 
15 that its doubling. From a cryptographic point of view it 
is good to be able to choose from the greatest possible 
number of curves and a curve is usually used for which 
the two-torsion of E ( F^^ ) is minimal or isomorphic to 

Z/4Z. For a given curve F^o the minimal two-torsion 
20 elliptic curves constitute exactly half of the set of 
elliptic curves defined on F^n . This is why, although it 
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is not totally general, the fastest version of the method 

described applies to a good proportion of the curves in 

interest in cryptography. It can also be applied when the 

elements of the body are represented in a normal basis. 

In the case of a polynomial basis, the memory space 

required is of the order of O(n^) bits. 

Some examples are given hereinafter, with reference 
to the accompanying drawings, in which: 

[-] figure Figure 1 is a graph showing a very 
particular elliptic curve that can be represented 
geometrically and is used hereinafter to explain 
elementary operations employed in the context of the 
invention; 

[-] figure Figure 2 is a diagram showing exchanges 
of information in accordance with the invention between 
two entities; 

[-] figures Figure 3 to 6 are flowcharts explaining 
some applications conforming to the invention; and 

[-] figure Figure 7 is a block diagram of another 
system for exchanging information between two entities A 
and B which can employ a cryptographic method according 
to the invention. 
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We will show how to calculate [1/2] P e G from 

P G G. We will then show how to replace the doublings of 

points by halvings to execute a multiplication by a 

scalar. 

We will use the usual affine representation of a 
point: P=(x,y) and the representation: (x, A.p ) with 

?lp=x+y/x. 

We derive y = x (x + ) / which uses only one 

multiplication, from the second representation. 

By proceeding in this way, to multiply a point by a 
scalar, we save on multiplications by calculating 
intermediate results using the representation (x, ) and 

the coordinate of the affine representation is determined 
only at the end of the calculation. 

A point P is halved in the following manner: 
Calculate [1/2] P from P. For this consider the two 
points of E: 

P = (x,y) = (x, X (x + ^p))^ 

and Q = (u,v) = (u, u (u + Xq) ) j_ 
such that: [2]Q = P_^ 

The formulas for doubling known in the art yield: 

(1) Aq = u + v/u^ 4^ 

(2) x = Aq^+ Aq + a, and -(-S-)- 

(3) y = (x+u) Aq + X + v^ 
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Multiplying (1) by u and inserting the value of v 

obtained in this way in (3), the above system becomes: 

V = u (u + Aq)^ 

Aq^+ Xq - ol X , and 

y = (x + u) Aq + x + u^h-uAq = u^ + x(Aq+1) 
or, since y = x (x + A,p ) : 

(i) AQ^+AQ = a + x^ -fi^ 

(ii) u^= (x (Aq+I) + y= (Aq + ?ip+x+l)_^ 

and (ii) 

(iii) V = u(u + Aq)^ (iii) 

Starting from P = (x,y) = (x, x (x + ) ) in affine 
coordinates or in the (x, ) representation, the above 
system of equations determines the following two types: 
[1/2] P GG and [1 [/2] P + Tse E ( ) \ G 

which give P by doubling. The following property enables 
it to be distinguished. 

Let E be a minimal two-torsion elliptic curve and 
P G E{F^,) = G X {O, T2} one of its odd order elements. 

Let Q g{[1/2] P, [1/2] P+ T2} and let Qi be one of the two 
points of E such that [2]Qi = Q. 

We have the necessary and sufficient condition: 
Q + [1/2] P«>Qi e E{F^„) (a) 

We deduce from this that it is possible to checlc if 
Q = [1/2] P by applying the formulas (i) , (ii) and (iii) 
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to Q and verifying if one of the points obtained belongs 
to E ( F^. ) . 

We can extend this process to an elliptic curve 
E (F^^) = G X E [2^] that is arbitrary by applying the 

5 formulas (i) , (ii) and (iii) k times: the first time to 
Q, to obtain a point Qi such that [2] Qi = Q; the ith time 
to Qi_i to obtain a point Qi such that [2] Qi = Qi-i. The 
resultant point Qk will be of the form: 

^rrrj P+T^.., if and only if Q = [1/2] P + T2 and will be of 

10 the form: 

, j P+T^i with 0 < i < k if and only if Q = [1/2] P. We 

therefore have the necessary and sufficient condition: 

Q = [1/2] P Qk E{F^^) 
This process is evidently lengthy if k is large. 

15 The above equation (a) shows that we can determine 

whether Q = [1/2] P or Q = [1/2] P + T2 by examining if the 

coordinates of Qi belong to F^^ or to a super-body of F^^ . 

As Qi is determined by the equations (i) , (ii) and (iii) , 
we have to study the operations used in solving these 
2 0 equations, which are not internal to the body but have 
their result on a super-body of F^n . The only possible 
instance is that of solving the second degree equation 

11 
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(i) : we must also calculate a square root to calculate 

the first coordinate of Qi, but in characteristic- two 

finding the square root is an operation internal to the 

body . Thus : 

5 Q = (u, v) = [1/2] P ^ 3Ag : + A = a + u 

Because finding the square root is internal to the 

body, this necessary and sufficient condition can also be 

written : 

Q = (u, v) = [1/2] P <=> 3Ae F^^ : + A = + u^ 

10 The preceding relation is used to optimize the 

algorithm referred to below in instances where the square 

root calculation time is not negligible. 

For P gG, the two solutions of (i) are A [i/2]p and 

A [1/2] p + 1 and we deduce from (ii) that the first 
15 coordinates of the associated points are u and (u + ^fx ) . 

We can therefore deduce an algorithm for calculating 

[1/2] P in the following manner: 

If F^n is a finite body of 2" elements, E ( F^n ) is 

the sub-group of an elliptic curve E defined by: 
20 ECF^^) = {{x,y)e F^^ X F^^ | y^ + xy = + ocx^ + p } U {o} a, 

p G F^„ , p ^ O, 
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and Et2^] is the set of points P of said elliptic curve 

such that P added 2^ times to itself gives the neutral 

element O when k is an integer greater than or equal to 1 

then a point P = (x,y) of said elliptic curve yields by 

said halving the point j^^j P = {uo, Vq) of said elliptic 

curve, obtained by effecting the following operations 
illustrated by the figure 3 flowchart: 

• seek a first value such that Xo^ + = a + x 

• calculate a second value Uq^ such that Uo^ = x (^o + D 
+ Y 

• if k has the value 1, check if the equation: A ^ + A = 

+ Uo^ has solutions in F^^ , 

• if so, calculate said halving as follows: 

Vo = Uo (Uo + Xo) 
and l^-^j P = (uo, Vo) 

• if not, add x to said second value Uo^ and 1 to said 
first value Xq and calculate said halving as in the 
preceding operation; 

• if k is greater than 1, perform the following iterative 
calculation : 
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seek a value X± such that A + X^i = a + Ui_i 

then calculate the value u^i such that u^i = ui-i {X± + X-i-i 
+ Ui_i +1) 

by incrementing i from i = l until the value u^-i^ is 
obtained 

• check whether the equation + X = u^k-i has 
solut ions in F^n 

• if so, calculate said halving is as follows: 



Vo = Uo (Uo + Xo) 
and l^^j P = (uo, Vo) 



• if not, add x to the second value Uo^ and 1 to said 
first value Xq to calculate said halving as in the 
preceding operation. 



If we choose to represent the point 



P = (Uo,Vo) 



of the elliptic curve by (vlq, Xq) with X^, = Uo + Vo/uo, then 
the algorithm conforms to the figure 4 flow chart: 

• seek a first value Xq such that Xq^ + Ao = Ot + x 

• calculate a second value Uo^ such that Uo^ = x {Xq + 1) + 
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• if k has the value 1, check if the equation: -\- Xq = 

+ u^o has solutions in F^n , 

• if so, calculate said halving as follows: 



[i]p . (u„, 



Uo 

and: |^|P = (uo, ?io) 

• if not, add x to said second value u©^ and 1 to said 

first value A,o ^ and calculate said halving as in the 
preceding operation; 

• if k is greater than 1 perform the following an 
iterative calculation : 

seek a value X± such that A + = a + Ui_i 
then calculate the value ui^ such that ui^ = Ui_i {X± 
+ Xi-i + Ui-i + 1) 

incrementing i from i = l until the value u^k-i is obtained 

• check if the equation + ^ = + u^k-i has solutions 
in F^, 

• if so, calculate said halving as well as follows: 

Uo = V^o^ 

and — P = (uo, Ao) 
2 
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• if not, add x to said second value Uo^ and 1 to said 
first value X-o "fee and calculate said halving as in the 
preceding operation . 

If we choose to represent the point P = (x,y) by 

(x, Ap) setting Ap = x+y/x which gives by said halving 



the point 



P = (uo,Vo) of said elliptic curve, then the 



algorithm conforms to the figure 5 flow chart: 

• seek a first value Ao such that X^^ + Xo = Ot + x 

• calculate a second value Uq^ such that Uq^ = x (X^o + Xp + 
X + 1) 

• if k has the value 1, check if the equation: A ^ + A = 

+ Uo^ has solutions in F^^ , 

• if so, calculate said halving as follows: 

Vo = Uo (Uo + Xo) 

and: l^^j^ = ^^o' ^^o) 



• if not , add x to said second value Uo^ and 1 to said 
first value Xo and calculate said halving as in the 

preceding operation; 
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• if k is greater than 1 perform the following an 
iterative calculation : 

seek a value A-i such that + X-i = a + ui-i 

then calculate the value u^i such that u^i = ui-i (X,i 

+ + Ui-i + 1) 

incrementing i from i = l until the value u^k-i is obtained 

• check if the equation X,^ + X- = + u^k-i has solutions 
in F^n 

• if so, calculate said halving as well as follows: 

Vo = Uo (Uo + Xo) 
and l^^j^ = ^^o' 

• if not, add x to said second value Uo^ and 1 to said 

first value X© and calculate said halving as in the 

preceding operation . 

Finally, if we choose to represent the point P= 
(x,y) by (x, Xp) with 

Xp = X + y/x which gives by said halving the point j^"^ j ^ = 

(uo, Vo) of the elliptic curve represented by (uq, Xq) with 

Xo = Uo + Vq/uo then the algorithm conforms to the figure 6 
algorithm : 

17 



Application No. 09/786,756 
Amendment Dated June 13, 2005 
Reply to Office Action of February 1 1 , 2005 
Annotated Specification Slieet Sliowing Changes 

• seek a first value Ao such that Ao^ + = a + x 

• calculate a second value u©^ such that Uo^ = x {Xo + Ap + 
X + 1) , 

• if k has the value 1 check if the equation A = 
+ Uo^ has solutions in , 



• if so, calculate said halving as follows: 

Uo 



and j^'^j^ = (^o/ Ao) 

• if not, add x to said second value Uo^ and 1 to said 

first value A© to and calculate said halving as in the 
preceding operat ion ; 

• if k is greater than 1 perform the following iterative 
calculation : 

seek a value Ai such that Ai^ + Ai = a + Ui_i 
then calculate the value u^i such that ui^ ^ Ui-i (Ai 
+ Ai-i + Ui-i + 1) 

incrementing i from i = l until the value u^k-i is obtained 

• check if the equation A^ + A = + u^k-i has solutions 

in F^^ 

• if so, calculate said halving as follows: 
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and 



P = (uo, K) 



]_ 

if not, add x to said second value Uo^ and 1 to said 



first value Xo and calculate said halving as in the 

preceding operation . 
5 We next describe how to perform the check, solve 

the second degree equation and calculate the square root 
in the algorithm for halving a point rapidly. We consider 
the normal basis and the polynomial basis. 

The normal basis results are known in the art. We 
10 can consider F^^ as the n-dimensional vectorial space on 

F2 . In a normal basis, an element of the body is 
represented by: 

i=0 

where PeF^^ is chosen such that: "^jP^j.-.^p^" ' } is a basis F^^ . 

15 In a normal basis, the square root is calculated by a 
left circular shift and squaring is effected by a right 
circular shift. The corresponding calculation times are 
therefore negligible . 

If the second degree equation: X,^ + A, == x has its 

2 0 solutions in F„ , a solution is then given by: 
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n-l i 

^ = 2^iP'' with: Ai=2xi l<i<n-l 

i=l k=l 

The time to calculate A is negligible compared to 
the time to calculate a multiplication of an inversion in 
the body. As the time to calculate a solution of the 
5 second degree equation is negligible, the check can be 
effected as follows: calculate a candidate A from x and 
check if + X = x. If not, the equation has no 

solution in F^o . 

In a polynomial basis, the following representation 
10 is used: 

n— 1 

X = ^XjT* with Xi e{0,l}. The square root of x can be 

i=o 

calculated by storing the element Vt if we note that: 

- in a body of characteristic- two, the square root 
is a morphism of the body, 

15 Jy ^=y\- x;n 

V even * even ' 

Grouping in x the even and odd powers of T and 
taking the square root, this becomes: 

i even i odd 

so that, to calculate a square root, it is sufficient to 
2 0 "reduce" two vectors by half and therefore to execute a 
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multiplication of a previously calculated value by an 

element of length n/2 . This is why the time to calculate 

a square root in a polynomial basis is equivalent to half 

the time to calculate a multiplication in the body. 

5 For the check and for solving the second degree 

equation, we consider F^n as a n-dimensional vectorial 

space on F2 . The application F defined as follows: 

F • F — > F 

' 2" 2° 

10 is then a linear kernel operator {O, l} 

For a given x, the equation X,^ + X- = x has its 
solutions in F^o if and only if the vector x is in the 

image of F. Im(F) is an (n - 1) -dimensional sub-space of 
F^n . For a given basis of F^n and the corresponding scalar 
15 product there exists a single non-trivial vector 
orthogonal to all the vectors of Im(F). Let w be that 
vector. We have: 

3X G F^n : X^ + X = X « x • w = 0 
Accordingly, the check can be performed by adding 

2 0 the components of x to which components of w equal to 1 

correspond. The time to perform this check is negligible. 

To solve the second degree equation: F(X) = X^ + X = 

X in a polynomial basis, we propose a simple and direct 
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method which imposes the storage of an n x n matrix. For 
this we look for a linear operator G such that:: 

VxGlm(F) :F(G(x))=(G(x))'+G(x)=x 
Let ^ vector such that Y^^Im(F) and define G as 

5 follows: 

G = F-' with f(tO= f y if : i= 0 

[ F(r) if: l<i<n-l 
Given that x == ^"~*jc.F(r' ) G Im(F) then G(x) is a 

solution of the second degree equation. One 
implementation consists of precalculat ing the matrix 

10 representing G in the basis {l,T, T"^"^} . In 

characteristic- two, the multiplication of a matrix by a 
vector is reduced to adding columns of the matrix to 
which a component of the vector equal to 1 corresponds. 
It follows that this method of solving a second degree 

15 equation consumes on average n/2 additions in the body 

Application of the principles explained above to 
scalar multiplication is described below. 

Let PeECF^n) be a point of odd order r, c a random 
20 integer and m the integer part of log2 (r) . We calculate 
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the product [c] P of a point by a scalar using the 

application for halving a point. 

We show that : 

For any integer c, there is a rational number of the 

form : 

I|f - {0,1} 

such that : 

c^^-i- (modr) 
i=o ^ 

Let <P> be the cyclic group generated by P. Because of 
the ring isomorphism: 

P = Z/rZ 

[k]P k 

The scalar multiplication can be calculated as follows: 



r 

using halving and addition. We can use the double -and- add 
algorithm well known in the art for these calculations. 
For that it is sufficient to replace doubling by halving 
in the algorithm. It is necessary to execute log2 (r) 
halvings and, on average, 1/2 log2 (r) additions. There 
are improved versions of the double -and- add algorithm 
which require only 1/3 log2 (r) additions on average. 
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Consequently, a scalar multiplication using a 

halving as defined above is obtained by means of the 

following operations : 

- if said scalar of the multiplication is denoted S, 
5 choose m+1 values 

So... Sm G {0,1} to define S as follows: 



- r being the aforementioned odd order and m being 
the single integer between log2(r) -1 and log2(r). 



point P of said elliptic curve by the scalar S by 
applying an algorithm consisting of determining the 
series of points (Qm+i/ Qm—, Qi-/ Qo) of said elliptic 
curve E such that : 



Qi = [Si]P + [2"]^"^ * ^ with o < i < m 

calculate the last point Qo of said series giving 
the result [S] P of said scalar multiplication. 

To add the initial point P to an intermediate 




10 



calculate the scalar multiplication [S] P of a 



15 



Qm+i = O (neutral element) 
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result 




we use the following algorithm, which is 



a slightly modified version of the standard algorithm: 
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Input: P = (x,y) in affine coordinates and Q 
u(u + Xq) ) represented by (u, Xq) 
Output: P + Q = (s, t) in affine coordinates 
algorithm : 

1. Calculate: X =~ ^ 

X + u 

2. Calculate: s = ?i^ + A. + a + x H-u 

3. Calculate: t = (s + x)?H-sH-y 



= (u. 



4 . Result : (s, t) 

This algorithm uses 



one 



inversion, 



three 



10 multiplications and one square root. 

Much time is saved by replacing doubling by 
halving. In affine coordinates, doubling and addition 
both require: one inversion, two multiplications and a 
square root. If the scalar of the multiplication by a 

15 scalar is represented by a bit vector of length m and of 
k non-zero components, scalar multiplication requires: 



operation 


double and add 


halve and add 


inversions 


m + k 


k 


multiplications 


2m + 2k 


m + 3k 


squarings 


m + k 


k 


solutions of 
X-^+A*=a+x 


0 


m 


square roots 


0 


m 


checks 


0 


m 
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Thus using halving saves tn inversions, m-k 
multiplications and m squarings at the cost of adding m 
second degree solutions, m square roots and m checks. 

In a polynomial basis, an execution time 
improvement of. around 50% can be obtained. 

In a normal basis, we estimate the time to 
calculate the square root, perform the check and solve 
the second degree equation negligible compared to the 
time to calculate a multiplication or an inversion. 
Assuming further that the time to calculate an inversion 
is equivalent to the time to calculate three 
multiplications, we arrive at an execution time 
improvement of 55%. 

Figure 2 is a diagram showing one possible 
application of the algorithms described above between two 
entities A and B exchanging information over a non- secure 
communication channel. Said communication channel can 
consist of simple electrical connections established 
between the two entities for the time of a transaction. 
It can also include a radio and/or optical 
telecommunication network. In this instance the entity A 
is a microcircuit card and the entity B is a server. Once 
connected to each other via said communication channel, 
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the two entities apply a common key construction 

protocol. For this purpose: 

- entity A has a secret key a 

- entity B has a secret key b 

They must generate a secret key x known only to 
them from a public key consisting of a point P of odd 
order r of a chosen non-supersingular elliptic curve E. 

The protocol employed is a Dif f ie-Hellman protocol, 
substituting for the usual "multiplicat ion-by- two" 
referred to as doubling the doubling operation in 
accordance with the invention described above and 
referred to as "halving" . 

The algorithm for this is as follows: 

- the first entity (for example A) calculates the 
scalar multiplication [a] P and sends the result point to 
the second entity, 

- the second entity (B) calculates the scalar 
multiplication [b] P and sends the result point to the 
first entity, 

- the two entities respectively calculate a common 
point (C) = (x,y) of said elliptic curve (E) by 
respectively effecting the scalar multiplications 
[a]([b]P) and [b] ( [a] P) , both equal to [a.b]P, and 
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- the two entities choose as their common key the 

coordinate x of said common point (C) obtained by said 

scalar multiplication [a.b]P, at least one of the 

preceding scalar multiplications, and preferably all of 

5 them, being effected by means of predefined halvings. 

To give a more precise example of this , figure 7 

shows a server B connected to a communication network 1 

via a communication interface 2, for example a modem 

interface. Similarly, a calculation station 3 is 

10 connected to the network 1 via a communication interface 

4. The station 3 is equipped with a microcircuit card 

reader 5 into which the microcircuit card A is inserted. 

The random access memory 6 of the server B contains 

a program 7 capable of executing cryptographic 

15 calculations on elliptic curves and in particular the 

product of a point by a scalar and the halving of a 

point . 

The card A contain a central processor unit 11, a 
random access memory (RAM) 8, a read-only memory (ROM) 9 
2 0 and an electrically erasable programmable read-only 
memory (EEPROM) 10. One of the memories 9 or 10 contains 
a program 12 capable of executing cryptographic 
calculations on elliptic curves and in particular the 
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product of a point by a scalar and the halving of a 

point . 

The two programs 7 and 12 have a common reference 
consisting of the same elliptic curve (E) and the same 
5 point P=(xo, yo) of (E) , 

When A wishes to construct in parallel with B a 
common secret key for securing dialog with B, it chooses 
a scalar a and sends to B the product Q=[a]P=(xi, yi) . In 
response to this, B chooses a scalar b and sends back to 
10 A the product R= [b] P = {x2, Y2) - 

A then calculates the product [a] R = [ab] P = 
(x, y) and B calculates the product [b] Q = [ab] P = 
(x, y) and A and B adopt x as a common secret key. 

These operations are represented in the table 
15 below. Those which are effected in the server B are 
indicated in the right-hand column and those which are 
effected in the card A are indicated in the left-hand 
column. The horizontal arrows symbolize transfers of 
information via the network 1. 

20 
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P = (xo, Yo) 
choice a 



P = (xo, Yo) 



Q = [a]P 



(xi, Yi) 



choice b 



[a]R 
keY 



X 



(X, Y) 



R = [b] P = (X2, Y2) 
[b] Q = {x,Y) 
keY = X 



10 



15 



20 



Another application of the invention applies 
between the two entities A and B in figure 7. It consists 
of a protocol for signing a message M transmitted between 
A and B via the non- secure channel, i.e. the network 1. 
The object of this protocol, the broad outlines of which 
are known in the art, is to make it certain that the 
message received bY one entitY was sent bY the other 
entitY- 

To this end, the sending entitY (for example A) has 
two permanent keYs, namelY a secret keY a and a public 
keY Q = [a] P, P being a point on an elliptic curve (E) , 
and P and (E) being known to and agreed on bY A and B. 
Another public keY is the point P of odd order r of the 
chosen non-supersingular elliptic curve E. The operations 
effected entail halvings in the sense defined above. 



In one example: 
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- the first entity (A) holding said pair of 
permanent keys constructs a single -use pair of keys, one 
key (g) chosen arbitrarily and the other key [g] P 
resulting from scalar multiplication of said arbitrarily 
chosen key (g) by the public point P of said elliptic 
curve, the coordinates of the key ( [g] P) being denoted 
(x,y} with 2 < g < r-2, 

- the first entity (A) converts the polynomial x of 
said single-use key [g] P = (x,y) into an integer i whose 
binary value is represented by the sequence of binary 
coefficients of said polynomial x, 

- said first entity (A) calculates a signature 
(c,d) of the message (M) as follows: 

c = i modulo r 

d = g'^ (M + ac) modulo r, 

- said first entity sends said message (M) and said 
signature (c, d) to said second entity; on receiving it: 

- said second entity (B) checks if the elements of 
said signature (c,d) each belong to the range [1, r-1] , 

- if not, it declares the signature invalid and 

stops 

- if so, said second entity (B) calculates three 
parameters : 

h = d'""" modulo r 
hi = Mh modulo r 
h2 = ch modulo r 
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- said second entity calculates a point T of said 
elliptic curve by summing the scalar multiplications of 
the points P and Q by the last two parameters cited: 

T = [hi] P + [hs] Q 

if the resultant point T is the neutral element, 
said second entity declares the signature invalid and 
stops . 

if it is not the neutral element, considering the 
point T with coordinates and y* : T = (x' ,y») : 

- said second entity (B) converts the polynomial x* 
of that point into an integer i * whose binary value is 
represented by the sequence of binary coefficients of 
said polynomial x', 

- said second entity (B) calculates c * = i • modulo 
r , and : 

- checks that c' = c: if so it validates said 
signature and if not it invalidates it, at least one of 
the scalar multiplication operations and preferably all 
of them being effected by means of the predefined 
halvings . 

These operations can be represented by the table 
below in which the operations effected in the server B 
are indicated in the right-hand column and the operations 
effected in the card A are indicated in the left-hand 
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column, the arrow between the two columns symbolizing the 

transfer of information via the network 1, 



33 



Application No. 09/786,756 
Amendment Dated June 13, 2005 
Reply to Office Action of February 1 1 , 2005 
Annotatad Specification Sheet Showing Chanqes 



choice g 2_< g ■< r-2 

[g] P = X, y 

message M 

c= i mod r 

d= g'^ (M+ac) mod r 

M, (c, d) 1 



► 1< c < r*- 1 


r no 




^yes 








error 




1 <r H <r T-1 

-1. ^ Vwl ^ J_ _L 


no 


1 


J^yes 








error 


-> 


h = d"''' mod 


r 




hi= Mh mod 


r 




h2= ch mod 


r 




T = [hi] P + 

1 


[hs] Q = (X' 




T = 0 ? 


yes 


-> 


1 no 












c ' = i ' mod 






c'=c ? 


no 




i 




-> 


yes 







GOOD BAD 
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